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DETAILED ACTION 



Response to Arguments 



1 . Applicant*s arguments filed 8/29/03 have been fully considered but they are not 
persuasive. In response to the argument of claim 1, 13, 17 24, 26, an Encapsulator function as 
defined by the appHcant (Page 21, line 25 - Page 22, 10) take a data in its raw form and convert 
it to a standard form. The data collector of BuUard's invention take data gathered from 
equipment interface (raw format) and convert to NAR (standard format), (Col 15, lines 45-67). 
This operation is consistent with the define operation of an Encapsulator 

An Aggregator as defined by applicants takes standard form data fi'om multiple source 
and combine them to produce a reduce form of a standard data, specifically tailored to support a 
collector or an appUcation (Page 20, lines 19-23). BuUard teaches about a Flow Aggregation 
Processor (FAP) that takes data from multiple sources to reduce them to one source tailored for a 
specific application (Col 18, lines 40-50). This operation is consistent with the define operation 
of an Aggregator. 

Data Storage as define by applicant is used to store standard data during processing and 
for recovery (Page 26, lines 25-31). Bullard teaches about a database management system that is 
used to store, search and retrieve data (Col 18, line 50-67). This operation is consistent with the 
define operation of a Data Storage. 

The operation of a rule chain is taught in the reference by means of the FAP using a 
aggregation policy to decide which data sources are combine to create a new standard record 
(Col 18, lines 40-50). 
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All the elements for the functioning of the invention are present in the reference. The 
components are not as integrated as in the case of the applicant but on a whole Bullard's 
invention produces the same result as the applicant. 

Claim Rejections - 35 USC§ 102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S. C. 1 02 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 35 1(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 2 1 (2) of such treaty in the English language. 

2. Claims 1-1 1,13-29 and 30-31are rejected under 35 U.S.C. 102(e) as being anticipated by 
US Patent No.6,405,251 by Bullard et al 

In claim 1 , Bullard teaches about a method for recording network usage, the method 
comprising the steps of (Fig 1): 

defining a network data collector including an encapsulator, an aggregator, and a data 
storage system (Col 18, lines 39-50); 

receiving a set of network accounting data via the encapsulator (Col 18, lines 39-67); 

converting the network accounting data set to a standard data format (Col 18, lines 39- 

67); 

processing the network accounting data set via the aggregator, including the steps of 
defining a rule chain and applying the rule chain to the network accounting data set to construct 
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an aggregation tree including creating an aggregated network accounting data set (Col 15, line 
45-Col 16, line 15), (Col 18, line 39-Col 19, line 30); and 

storing the aggregated network accounting data set in the data storage system (Col 19, 
lines 20-30). 

In claim 2, BuUard teaches about a method of claim 1, wherein the step of applying the 
rule chain to the network accounting data set to construct the aggregation tree includes the step 
of applying a rule from the rule chain to the network accounting data set to define a 0 
group node (Col 15, line 45-Col 16, line 15), (Col 18, line 39-Col 19, line 30). 

In claim 3, Bullard teaches about a method of claim 2, wherein the rule is a match rule 
(Coin, lines 30-50), 

In claim 4, Bullard teaches about a method of claim 1, wherein the step of applying the 
rule chain to the network accounting data set to construct the aggregation tree includes the step 
of applying a set of match rules to the network accounting data set to define a 
hierarchy of group nodes within the aggregation tree (Col 17, lines 30-50). 

In claim 5, Bullard teaches about a method of claim 4, wherein the step of applying the 
rule chain to the network accounting data set to construct the aggregation tree includes the step 
of applying an aggregation rule to the match group node to create the aggregated network 
accounting data set. (Col 14, line 53-Col 15, line 25) 

In claim 6, Bullard teaches about a method of claim 1, wherein the step of applying the 
rule chain to the network accounting data set to construct the aggregation tree includes the step 
of applying a data manipulation rule to the network accounting data set (Col 15, Hne 45-Col 16, 
line 15). 
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In claim 7, BuUard teaches about a method of claim 6, fixrther comprising the step of 
defining the data manipulation rule to be an adornment rule " enhancement" (Col 15, line 45-Col 
16, line 15). 

In claim 8, BuUard teaches about a method of claim 6, further comprising the step of 
defining the data manipulation rule to be a filtering rule (Col 17, lines 30-50). 

In claim 9, BuUard teaches about a method of claim 1, wherein the network accounting 
data set is a set of session data (Col 8, lines 15-38), (Table 1). 

In claim 10, BuUard teaches about a method of claim 1, wherein the network accounting 
data set is a set of usage data (Col 8, lines 15-38), (Table 1). 

In claim 1 1, BuUard teaches about a method of claim 1, further comprising the step of 
defining a data flush interval; and wherein the step of storing the aggregated network accounting 
data set includes the step of transferring the aggregated network accounting data to the data 
storage system after a period of time associated with the data flush interval (Col 14, lines 43-55). 

In claim 13, BuUard teaches about a method for recording network usage including 
correlating of network usage information and network session information, the method 
comprising the steps of (Fig 1): 

defining a network data correlator collector including an encapsulator, an aggregator, and 
a data storage system (Col 18, lines 39-67); 

receiving a set of network session data via the encapsulator (Col 8, lines 15-38), (Table 
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processing the network session data set via the aggregator, including the steps of defining 
a first rule chain and applying the first rule chain to the network session data to construct an 
aggregation tree (Col 15, line 45-Col 16, line 15); 

receiving a set of network usage data via the encapsulator (Col , 8, lines 15-38), (Table 1); 

processing the network usage data set via the aggregator, including the steps of defining a 
second rule chain and applying the second rule chain to the network usage data and the 
aggregation tree to construct a correlated aggregation tree (Col 15, line 45-Col 16, line 15); 

determining a correlated data set fi-omthe correlated aggregation tree (Col 18, lines 39- 
67); and 

storing the correlated data set in the data storage system (Col 18, lines 39-67). 

In claim 14, BuUard teaches about a method of claim 13, wherein the network session 
data set is in a standard data format received from a session data collector having an 
encapsulator, an aggregator and a data storage system (Col 15, line 45-Col 16, line 15). 

In claim 15, Bullard teaches about a method of claim 14, wherein the network usage data 
set is in the standard data format received from a usage data collector having an encapsulator, an 
aggregator and a data storage system (Col 15, line 45-Col 16, line 15). 

In claim 16, Bullard teaches about a method of claim 13, further comprising the step of 
defining the first rule set to be different than the second rule set (Col 18, lines 39-67). 

In claim 17, Bullard teaches about a method for recording network usage comprising the 
steps of (Fig 1): 

defining a first network data collector including a first encapsulator, a first aggregator, 
and a first data storage system (Col 15, line 45-Col 16, line 15); 
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receiving a first set of network data via the first encapsulator (Col 15, line 45-Col 16, line 



processing the first network data set via the first aggregator, including the steps of 
defining an aggregation rule chain and determining a first set of aggregated data by applying the 
aggregation rule chain to the first set of network data (Col 17, lines 30-50); and 

storing the first aggregated network data set in the first data storage system (Col 15, line 
45-Col 16, line 15). 

In claim 18, BuUard teaches about a method of claim of claim 17, wherein the step of 
applying the aggregation rule chain to the first set of network data further comprises the steps of 
constructing an aggregation tree (Col 17, lines 30-50); and 

determining the first aggregated network data set fi-om the aggregation tree (Col 15, line 
(Col 17, lines 30-60). 

In claim 19, Bullard teaches about a method of claim 18, wherein the step of constructing 
an aggregation tree further includes the steps of 

defining the first network data set to includes a first network data event and a second 
network data event (Col 9, lines 46-55), (Col 17, lines 30-50); 

applying the aggregation rule chain to the first network data event to construct a 
hierarchy of group nodes within the aggregation tree (Col 15, line 45-Col 16, line 15), (Col 18, 
line 39-Col 19, line 30); and 

applying the aggregation rule chain to the second network data event to locate similar 
group nodes according to a predefined set of match rules, if no matching group nodes exist. 



15); 
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extending the hierarchy of group nodes within the aggregation tree by creating additional group 
nodes (Col 17, lines 30-50), (Col 18, line 39-Col 19, line 30), 

In claim 20, Bullard teaches about a method of claim 19, wherein the step of applying the 
aggregation rule chain to the first network data event further includes the steps of 

defining the aggregation rule chain to include a first match rule for matching source IP 
address (Col 13, lines 20-30), (Col 8, lines 15-38), (Table 1)^ 

defining the first network data event to include a first source IP address(Col 13, lines 20- 
30), (Col 8, lines 15-38), (Table 1); 

applying the first match rule to the first network data event, including determining 
whether the aggregation tree includes a first group node matching the first source IP address; and 

if a matching first group node does not exist, creating the first group node for the first 
source IP address (Col 17, lines 30-50). 

In claim 21, Bullard teaches about a method of claim 20, wherein the step of applying 
aggregation rule chain to the first network data event further includes the steps of 

defining the aggregation rule chain to include a second match rule for matching 
destination IP address (Col 18, line 39-Col 19, line 30); 

defining the first network data event to include a first destination IP address(Col 13, lines 
20-30), (Col 8, lines 15-38), (Table 1); 

applying the second match rule to the first network data event, including determining 
whether the aggregation tree includes a second group node matching the first destination IP 
address (Col 18, line 39-Col 19, line 30); and if a matching second group node does not exist, 
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creating the second group node for the first destination IP address (Col 18, line 39-Col 19, line 
30). 

In claim 22, Bullard teaches about a method of claim 21, wherein the step of applying the 
aggregation rule chain to the first network data event further includes the steps of 

defining the aggregation rule set to include an aggregation rule (Col 18, lines 39- 

67); 

defining the first network data event to include a port number and volume of 

information (Col 8, lines 15-38), (Table 1); 

applying the aggregation rule to the first network data event, including copying 

the port number, source IP address, destination IP address and volume information to the second 

group node (Col 1 8, line 39-Col 19, line 30). 

In claim 23, Bullard teaches about a method of claim 17, further comprising the steps of 
defining a second network data collector including a second encapsulator, a second 

aggregator, and a second data storage system (Col 15, line 45-Col 16, line 15); 

receiving a second set of network data via the second network encapsulator (Col 15, line 

45-Col 16, line 15); 

processing the second network data set via the second aggregator, including the steps of 
defining a second rule chain and applying the second rule chain to the second set of network data 
to define a second set of aggregated network data (Col 15, line 45-Col 16, line 15); and 

storing the second aggregated network data set in the second data storage system (Col 1 5, 
line 45-Col 16, line 15), 
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In claim 24, Bullard teaches about a network usage recording system having a network 
data collector, the network data collector comprising (Fig 1): 

an encapsulator for receiving a set of network accounting data and converting the 
network accounting data set to a standard data format (Col 15, line 45-Col 16, line 15); 

an aggregator for processing the network accounting data set, the aggregator including a 
defined rule chain, wherein the aggregator applies the rule chain to the network accounting data 
set to construct an aggregation tree, and determines a set of aggregated network accounting data 
from the aggregation tree (Col 18, line 39-Col 19, line 30); and 

a data storage system for storing the aggregated network accounting data (Col 1 8, Knes 

39-67). 

In claim 25, Bullard teaches about a system of claim 24, wherein the process of applying 
the rule chain to the network accounting data performs data reduction on the network data (Col 
17, lines 30-50), (Col 18, lines 39-67). 

In claim 26, Bullard teaches about a network usage recording system having a network 
data correlator collector, the network data correlator collector comprising (Col 18, lines 39-67): 

an encapsulator, which receives a set of network session data (Col 18, lines 39-67); 

an aggregator for processing the network session data set, the aggregator including a 
defined first rule chain, wherein the aggregator applies the first rule chain to the network session 
data set to construct an aggregation tree (Col 18, line 39-Col 19, line 30); 

wherein the encapsulator receives a set of network usage data, and the aggregator 
processes the network usage data set, the aggregator including a defined second rule chain, 
wherein the aggregator applies the second rule chain to the network usage data set and the 
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aggregation tree to construct a correlated aggregation tree, and determines a correlated data set 
from the correlated aggregation tree (Col 18, line 39-Col 19, line 30); and 

a data storage system for storing the correlated data set (Col 18, lines 39-67). 

In claim 27, BuUard teaches about a system of claim 26, wherein the network session 
data set is in a standard data format received from a session data collector having an 
encapsulator, an aggregator and a data storage system (Col 8, lines 15-38), (Table 1), (Col 15, 
line 45-Col 16, line 15). 

In claim 28, BuUard teaches about a system of claim 27, wherein the network usage data 
set is in the standard data format received from a usage data collector having an encapsulator, an 
aggregator and a data storage system (Col 8, lines 15-38), (Table 1), (Col 15, Hne 45-Col 16, line 
15).. 

In claim 29, Bullard teaches about a system of claim 26, further wherein the first rule set 
is different than the second rule set (Col 18, lines 39-67). 

In claim 30, Bullard teaches about a method for recording network usage comprising: 

defining a first network data collector including a first encapsulator(Col 15, lines 45-67), 
a first aggregator (Col 18, lines 40-50), and a first data storage system (Col 18, line 50-67); 

receiving a first set of network data via the first encapsulator(Col 15, lines 45-67); 

processing the first network data set via the first aggregator(Col 18, lines 40-50), 
including the steps of defining an aggregation rule chain and determining a first set of aggregated 
data by applying the aggregation rule chain to the first set of network data (Col 18, lines 40- 
50);and 
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storing the first aggregated network data set in the first data storage system (Col 18, lines 

50-67); 

wherein applying the aggregation rule chain to the first set of network data further 
comprises: 

constructing an aggregation tree(Col 15, lines 45-67); and 

determining the first aggregated network data set from the aggregation tree (Col 19, line 

10-25); 

wherein constructing an aggregation tree further includes defining the first network data 
set to includes a first network data event and a second network data event (Col 19, line 10-25); 

applying the aggregation rule chain to the first network data event to construct a 
hierarchy of group nodes within the aggregation tree (Col 8, lines 1-38) (Fig. 21); and 

applying the aggregation rule chain to the second network data event to locate similar 
group nodes according to a predefined set of match rules (Col 19, line 10-25), if no matching 
group nodes exist, extending the hierarchy of group nodes within the aggregation tree by creating 
additional group nodes (Col 19, line 10-25); 

wherein applying the aggregation rule chain to the first network data event further 
includes: 

defining the aggregation rule chain to include a first match rule for matching source EP 
address (Col 8, lines 1-38), (Fig. 11c); 

defining the first network data event to include a first source IP address (Col 8, lines 1- 
38), (Fig. 11c); 
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applying the first match rule to the first network data event, including determining 
whether the aggregation tree includes a first group node matching the first source IP address (Col 
8, lines 1-38), (Fig. 11c), (Fig. 18); and 

if a matching first group node does not exist, creating the first group node for the first 
source IP address (Col 19, line 10-25); 

wherein applying aggregation rule chain to the first network data event further includes: 

defining the aggregation rule chain to include a second match rule for matching 
destination IP address (Col 19, line 10-25) ; 

defining the first network data event to include a first destination IP address (Col 8, lines 

1-38); 

applying the second match rule to the first network data event, including determining 
whether the aggregation tree includes a second group node matching the first destination IP 
address (Col 19, line 10-25); and 

if a matching second group node does not exist, creating the second group node for the 
first destination IP address (Col 19, line 10-25); 

wherein applying the aggregation rule chain to the first network data event fiirther 
includes: 

defining the aggregation rule set to include an aggregation rule (Col 19, line 10-25); 
defining the first network data event to include a port number and volume of information 
(Col 8, lines 1-38); 
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applying the aggregation rule to the first network data event, including copying the port 
number, source IP address, destination IP address and volume information to the second group 
node (Col 8, lines 1-38), (Col 19, line 10-25), (Fig. 18). 

In claim 31, BuUard teaches about a method of claim 30, further comprising: 
defining a second network data collector including a second encapsulator(Col 15, lines 

45-67), a second aggregator(Col 18, lines 40-50), and a second data storage system (Col 18, line 

50-67) (Fig. 5), (Fig. 14); 

receiving a second set of network data via the second network encapsulator(Col 15, lines 

45-67); 

processing the second network data set via the second aggregator(Col 15, lines 45-67), 
including: 

defining a second rule chain and applying the second rule chain to the second set of 
network data to define a second set of aggregated network data (Col 16, line 1-15); and 

storing the second aggregated network data set in the second data storage system(Col 18, 
lines 50-67). 

Claim Rejections - 35 USC §103 
3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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4. Claiml2 is rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
No.6,405,251 by Bullard et al in view of US Patent No.6,199,195 by Goodwin et al. 

5. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 
(1966), that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating obviousness 
or nonobviousness. 

In claim 12, Bullard teaches about a method of claim 1, further comprising the step of 
defining a rule within the rule chain (Col 22, lines 45-60) but does not teach about a Java object 
class, which allows additional rule types to be added to the rule chain corresponding to the Java 
object class. Goodwin teaches about the automatic generation in which Java is used to generate 
a Java object class that allows additional rule types to be added to the rule chain corresponding to 
the Java object class (Col 2, lines 20-30). 

It would have been obvious at the time of the invention for some one of ordinary skill to 
use Java programming for its portability. A network system is made up of different network 
components that operate on there own individual platform. In the case of other program 
languages, each platform requires its own special program so that it can operate. Maintaining 
multiple programs, require more effort on the part of the administrator. Because of its portability. 
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Java is used in these multi-platform environment. A Java program will operate across different 
platform. Java requires less maintenance and thus increases network productivity. 

Conclusion 

6. TfflS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1. 136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

7. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

US Patent No. 6,230,203 by Koperda et al., teaches about a system and method for 
providing statistics for flexible billing in a cable environment. 

US Patent No. 6,446,200 by Ball et al., teaches about a Service management. 



Application/Control Number: 09/560,032 



Page 17 



Art Unit: 2143 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael S. A. Delgado whose telephone number is 703-305- 
8057. The examiner can normally be reached on 8 AM - 4.30PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David A Wiley can be reached on (703)308-5221 . The fax phone numbers for the 
organization where this application or proceeding is assigned are 703-746-7239 for regular 
communications and 703-746-7239 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703)305-3900. 



MD 

October 17, 2003 
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